Skip to main content

Linux Kernel CVE-2026-53298

| EUVDEUVD-2026-39833 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-26 Linux GHSA-qvrw-vpg6-fx6m
Linux Denial Of Service Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required; pure availability impact via kernel crash; no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 03:53 vuln.today
CVSS changed
Jul 08, 2026 - 03:52 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
MEDIUM 5.5
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()

If queue entry or DMA descriptor list allocation fails in airoha_qdma_init_rx_queue routine, airoha_qdma_cleanup() will trigger a NULL pointer dereference running netif_napi_del() for RX queue NAPIs since netif_napi_add() has never been executed to this particular RX NAPI. The issue is due to the early ndesc initialization in airoha_qdma_init_rx_queue() since airoha_qdma_cleanup() relies on ndesc value to check if the queue is properly initialized. Fix the issue moving ndesc initialization at end of airoha_qdma_init_tx routine. Move page_pool allocation after descriptor list allocation in order to avoid memory leaks if desc allocation fails.

AnalysisAI

NULL pointer dereference in the Linux kernel's airoha QDMA network driver crashes the kernel when RX queue initialization fails mid-way through allocation. The flaw exists in airoha_qdma_init_rx_queue() where early ndesc initialization causes the cleanup routine to call netif_napi_del() on NAPI structures never registered via netif_napi_add(), dereferencing a null pointer and causing a local denial of service. No public exploit identified and EPSS at 0.17% (6th percentile) reflects minimal real-world exploitation probability; impact is constrained to systems running Airoha QDMA-based network hardware.

Technical ContextAI

CWE-476 (NULL Pointer Dereference) manifests in the airoha Ethernet QDMA driver within the Linux kernel networking subsystem (net/ethernet/mediatek/airoha). The driver manages DMA descriptor rings and NAPI (New API) interrupt coalescing for Airoha/MediaTek-based switching hardware. The root cause is a lifecycle ordering bug in the error path: ndesc is written before netif_napi_add() is called, so if subsequent allocation of queue entries or DMA descriptor lists fails, the cleanup function airoha_qdma_cleanup() reads ndesc as non-zero and invokes netif_napi_del() on a NAPI structure that was never initialized, dereferencing a null pointer. A secondary fix moves page_pool allocation after descriptor list allocation to prevent memory leaks on partial failures. CPE data confirms the affected product is cpe:2.3:a:linux:linux across the vulnerable commit range starting from 23020f04932701d5c8363e60756f12b43b8ed752.

RemediationAI

Upstream fix available via kernel stable git at https://git.kernel.org/stable/c/d36be272adda7f313e39dd118086955d993bf6a7, https://git.kernel.org/stable/c/4d4acfa348a1d8c0941004823662ede0fdb5dea5, https://git.kernel.org/stable/c/14dc48e5ba73d5c69559bf1a1a6884f7843aade7, and https://git.kernel.org/stable/c/379050947a1828826ad7ea50c95245a56929b35a. Patched released versions per EUVD are Linux 6.12.91, 6.18.33, 7.0.10, and 7.1 - upgrade to any of these. If upgrading is not immediately feasible and the system does not use Airoha QDMA networking hardware, the airoha driver (if compiled as a module) can be blacklisted via /etc/modprobe.d/ to eliminate exposure entirely with no side effects on non-Airoha systems. On systems that do use the hardware, restricting local user privileges to prevent deliberate triggering of allocation failures is a partial compensating control, though the primary fix is a kernel update.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53298 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy